@agent-native/dispatch 0.40.41-same-host-mcp-20261027-20261027081850 → 0.40.41

package/src/server/lib/workspace-app-chat-proxy.spec.ts

@@ -1,16 +1,28 @@
+import { getRequestContext } from "@agent-native/core/server";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   getSession: vi.fn(),
   getOrgContext: vi.fn(),
+  getAppProductionUrl: vi.fn(),
+  getForwardedRequestOrigin: vi.fn(),
+  resolveAppRuntimeUrl: vi.fn(),
   createWorkspaceSsoEmbedSession: vi.fn(),
   createGrantedDispatchMcpEmbedSession: vi.fn(),
+  createWorkspaceSsoEmbedSessionForWorkspaceAppChat: vi.fn(),
+  createGrantedDispatchMcpEmbedSessionForWorkspaceAppChat: vi.fn(),
 }));
 
 vi.mock("@agent-native/core/server", async (importOriginal) => {
   const actual =
     await importOriginal<typeof import("@agent-native/core/server")>();
-  return { ...actual, getSession: mocks.getSession };
+  return {
+    ...actual,
+    getAppProductionUrl: mocks.getAppProductionUrl,
+    getForwardedRequestOrigin: mocks.getForwardedRequestOrigin,
+    getSession: mocks.getSession,
+    resolveAppRuntimeUrl: mocks.resolveAppRuntimeUrl,
+  };
 });
 
 vi.mock("@agent-native/core/org", () => ({
@@ -21,6 +33,10 @@ vi.mock("./mcp-gateway.js", () => ({
   createWorkspaceSsoEmbedSession: mocks.createWorkspaceSsoEmbedSession,
   createGrantedDispatchMcpEmbedSession:
     mocks.createGrantedDispatchMcpEmbedSession,
+  createWorkspaceSsoEmbedSessionForWorkspaceAppChat:
+    mocks.createWorkspaceSsoEmbedSessionForWorkspaceAppChat,
+  createGrantedDispatchMcpEmbedSessionForWorkspaceAppChat:
+    mocks.createGrantedDispatchMcpEmbedSessionForWorkspaceAppChat,
 }));
 
 import {
@@ -28,7 +44,12 @@ import {
   createWorkspaceAppChatProxyHandler,
 } from "./workspace-app-chat-proxy.js";
 
+type WorkspaceAppChatProxyEvent = Parameters<
+  ReturnType<typeof createWorkspaceAppChatProxyHandler>
+>[0];
+
 const APP_ORIGIN = "https://analytics.agent-native.com";
+const WORKSPACE_ORIGIN = "https://beta.agent-workspace.builder.io";
 const START_URL = `${APP_ORIGIN}/_agent-native/embed/start?ticket=ticket-1`;
 
 function embedToken(expiresInSeconds = 3600): string {
@@ -45,7 +66,7 @@ function embedToken(expiresInSeconds = 3600): string {
 
 function proxyEvent(path: string, init: RequestInit = {}) {
   const url = new URL(`https://dispatch.agent-native.com${path}`);
-  return { url, req: new Request(url, init) };
+  return { url, req: new Request(url, init) } as WorkspaceAppChatProxyEvent;
 }
 
 function mountedProxyEvent(
@@ -58,7 +79,7 @@ function mountedProxyEvent(
     url,
     req: new Request(url, init),
     context: { _mountedPathname: mountedPath },
-  };
+  } as WorkspaceAppChatProxyEvent;
 }
 
 function stubFetch(
@@ -66,7 +87,11 @@ function stubFetch(
     url: string,
     init: RequestInit,
   ) => Response | Promise<Response>,
-  options: { token?: string; startStatus?: number } = {},
+  options: {
+    token?: string;
+    startStatus?: number;
+    redirectLocation?: (token: string) => string;
+  } = {},
 ) {
   return vi.fn(async (input: string | URL, init: RequestInit = {}) => {
     const url = String(input);
@@ -78,7 +103,9 @@ function stubFetch(
       return new Response("", {
         status: 302,
         headers: {
-          location: `/?embedded=1&__an_embed_token=${encodeURIComponent(token)}`,
+          location:
+            options.redirectLocation?.(token) ??
+            `/?embedded=1&__an_embed_token=${encodeURIComponent(token)}`,
         },
       });
     }
@@ -91,11 +118,46 @@ describe("workspace app chat proxy", () => {
     clearWorkspaceAppChatSessions();
     mocks.getSession.mockResolvedValue({ email: "owner@example.com" });
     mocks.getOrgContext.mockResolvedValue({ orgId: "org-1" });
+    mocks.getAppProductionUrl.mockReturnValue(
+      "https://dispatch.agent-native.com",
+    );
+    mocks.getForwardedRequestOrigin.mockReturnValue(
+      "https://dispatch.agent-native.com",
+    );
+    mocks.resolveAppRuntimeUrl.mockReturnValue(
+      "https://workspace.agent-native.com/dispatch",
+    );
     mocks.createWorkspaceSsoEmbedSession.mockResolvedValue({
       startUrl: START_URL,
       app: "analytics",
     });
     mocks.createGrantedDispatchMcpEmbedSession.mockReset();
+    mocks.createWorkspaceSsoEmbedSessionForWorkspaceAppChat.mockImplementation(
+      async (appId: string) => {
+        const result = await mocks.createWorkspaceSsoEmbedSession({
+          app: appId,
+          path: "/",
+          chrome: "minimal",
+        });
+        return {
+          startUrl: result.startUrl,
+          appBaseUrl: new URL(result.startUrl).origin,
+        };
+      },
+    );
+    mocks.createGrantedDispatchMcpEmbedSessionForWorkspaceAppChat.mockImplementation(
+      async (appId: string) => {
+        const result = await mocks.createGrantedDispatchMcpEmbedSession({
+          app: appId,
+          path: "/",
+          chrome: "minimal",
+        });
+        return {
+          startUrl: result.startUrl,
+          appBaseUrl: new URL(result.startUrl).origin,
+        };
+      },
+    );
     vi.spyOn(console, "warn").mockImplementation(() => undefined);
   });
 
@@ -127,6 +189,248 @@ describe("workspace app chat proxy", () => {
     expect(headers.get("cookie")).toBeNull();
   });
 
+  it("forwards chat through the Workspace app mount returned by embed exchange", async () => {
+    const appId = "customer-ticket-triage";
+    const appBaseUrl = `${WORKSPACE_ORIGIN}/dispatch/apps/${appId}`;
+    mocks.createWorkspaceSsoEmbedSessionForWorkspaceAppChat.mockResolvedValue({
+      startUrl: `${WORKSPACE_ORIGIN}/dispatch/_agent-native/embed/start?ticket=ticket-1`,
+      appBaseUrl,
+    });
+    const fetchImpl = stubFetch(() => new Response("ok", { status: 200 }), {
+      redirectLocation: (token) =>
+        `/dispatch/apps/${appId}/?embedded=1&__an_embed_token=${encodeURIComponent(token)}`,
+    });
+    const handler = createWorkspaceAppChatProxyHandler({ fetchImpl });
+
+    const response = await handler(
+      proxyEvent(`/_agent-native/workspace-app-chat/${appId}`, {
+        method: "POST",
+        body: JSON.stringify({ messages: [] }),
+        headers: { "content-type": "application/json" },
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    const chatCall = (fetchImpl as unknown as ReturnType<typeof vi.fn>).mock
+      .calls[1];
+    expect(chatCall[0]).toBe(`${appBaseUrl}/_agent-native/agent-chat`);
+    expect(
+      (chatCall[1].headers as Headers).get("x-agent-native-embed-target"),
+    ).toBe(`/dispatch/apps/${appId}/`);
+  });
+
+  it("does not send an embed token to a sibling app on the same origin", async () => {
+    const appId = "customer-ticket-triage";
+    mocks.createWorkspaceSsoEmbedSessionForWorkspaceAppChat.mockResolvedValue({
+      startUrl: `${WORKSPACE_ORIGIN}/dispatch/_agent-native/embed/start?ticket=ticket-1`,
+      appBaseUrl: `${WORKSPACE_ORIGIN}/dispatch/apps/${appId}`,
+    });
+    const fetchImpl = stubFetch(
+      () => new Response("unexpected", { status: 200 }),
+      {
+        redirectLocation: (token) =>
+          `/dispatch/apps/other-app/?embedded=1&__an_embed_token=${encodeURIComponent(token)}`,
+      },
+    );
+    const handler = createWorkspaceAppChatProxyHandler({ fetchImpl });
+
+    const response = await handler(
+      proxyEvent(`/_agent-native/workspace-app-chat/${appId}`, {
+        method: "POST",
+      }),
+    );
+
+    expect(response.status).toBe(502);
+    expect(fetchImpl).toHaveBeenCalledTimes(1);
+    expect(((await response.json()) as { error: string }).error).toContain(
+      "outside its app mount",
+    );
+  });
+
+  it("rejects encoded path segments before forwarding an embed token", async () => {
+    const appId = "customer-ticket-triage";
+    mocks.createWorkspaceSsoEmbedSessionForWorkspaceAppChat.mockResolvedValue({
+      startUrl: `${WORKSPACE_ORIGIN}/dispatch/_agent-native/embed/start?ticket=ticket-1`,
+      appBaseUrl: `${WORKSPACE_ORIGIN}/dispatch/apps/${appId}`,
+    });
+    const fetchImpl = stubFetch(
+      () => new Response("unexpected", { status: 200 }),
+      {
+        redirectLocation: () =>
+          `/dispatch/apps/${appId}%2F..%2Fother-app/?embedded=1&__an_embed_token=encoded`,
+      },
+    );
+    const handler = createWorkspaceAppChatProxyHandler({ fetchImpl });
+
+    const response = await handler(
+      proxyEvent(`/_agent-native/workspace-app-chat/${appId}`, {
+        method: "POST",
+      }),
+    );
+
+    expect(response.status).toBe(502);
+    expect(fetchImpl).toHaveBeenCalledTimes(1);
+    expect(((await response.json()) as { error: string }).error).toContain(
+      "outside its app mount",
+    );
+  });
+
+  it("allows an encoded app mount when the redirect preserves that mount", async () => {
+    const appId = "customer-ticket-triage";
+    const appBaseUrl = `${WORKSPACE_ORIGIN}/dispatch/apps/customer%20ticket-triage`;
+    mocks.createWorkspaceSsoEmbedSessionForWorkspaceAppChat.mockResolvedValue({
+      startUrl: `${WORKSPACE_ORIGIN}/dispatch/_agent-native/embed/start?ticket=ticket-1`,
+      appBaseUrl,
+    });
+    const fetchImpl = stubFetch(() => new Response("ok", { status: 200 }), {
+      redirectLocation: (token) =>
+        `/dispatch/apps/customer%20ticket-triage/?embedded=1&__an_embed_token=${encodeURIComponent(token)}`,
+    });
+    const handler = createWorkspaceAppChatProxyHandler({ fetchImpl });
+
+    const response = await handler(
+      proxyEvent(`/_agent-native/workspace-app-chat/${appId}`, {
+        method: "POST",
+      }),
+    );
+
+    expect(response.status).toBe(200);
+    const chatCall = fetchImpl.mock.calls[1];
+    expect(chatCall[0]).toBe(`${appBaseUrl}/_agent-native/agent-chat`);
+  });
+
+  it("does not send an embed token to a cross-origin exchange redirect", async () => {
+    const fetchImpl = stubFetch(
+      () => new Response("unexpected", { status: 200 }),
+      {
+        redirectLocation: (token) =>
+          `https://attacker.example/?__an_embed_token=${encodeURIComponent(token)}`,
+      },
+    );
+    const handler = createWorkspaceAppChatProxyHandler({ fetchImpl });
+
+    const response = await handler(
+      proxyEvent("/_agent-native/workspace-app-chat/analytics", {
+        method: "POST",
+      }),
+    );
+
+    expect(response.status).toBe(502);
+    expect(fetchImpl).toHaveBeenCalledTimes(1);
+    expect(((await response.json()) as { error: string }).error).toContain(
+      "untrusted origin",
+    );
+  });
+
+  it("preserves a configured request origin for both embed-session signing paths", async () => {
+    const requestOrigin = "https://dispatch.agent-native.com";
+    mocks.createWorkspaceSsoEmbedSession.mockImplementation(async () => {
+      expect(getRequestContext()?.requestOrigin).toBe(requestOrigin);
+      throw new Error("Workspace sign-in is not configured for this app.");
+    });
+    mocks.createGrantedDispatchMcpEmbedSession.mockImplementation(async () => {
+      expect(getRequestContext()?.requestOrigin).toBe(requestOrigin);
+      return { startUrl: START_URL, app: "analytics" };
+    });
+    const handler = createWorkspaceAppChatProxyHandler({
+      fetchImpl: stubFetch(() => new Response("ok", { status: 200 })),
+    });
+
+    const response = await handler(
+      proxyEvent("/_agent-native/workspace-app-chat/analytics"),
+    );
+
+    expect(response.status).toBe(200);
+    expect(mocks.getForwardedRequestOrigin).toHaveBeenCalledTimes(1);
+    expect(mocks.createGrantedDispatchMcpEmbedSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("accepts a request origin from the configured runtime URL", async () => {
+    const runtimeOrigin = "https://workspace.agent-native.com";
+    mocks.getForwardedRequestOrigin.mockReturnValue(runtimeOrigin);
+    const observedOrigins: string[] = [];
+    mocks.createWorkspaceSsoEmbedSession.mockImplementation(async () => {
+      observedOrigins.push(getRequestContext()?.requestOrigin ?? "");
+      return { startUrl: START_URL, app: "analytics" };
+    });
+    const handler = createWorkspaceAppChatProxyHandler({
+      fetchImpl: stubFetch(() => new Response("ok", { status: 200 })),
+    });
+
+    const response = await handler(
+      proxyEvent("/_agent-native/workspace-app-chat/analytics"),
+    );
+
+    expect(response.status).toBe(200);
+    expect(observedOrigins).toEqual([runtimeOrigin]);
+  });
+
+  it("ignores untrusted forwarded origins for context and session caching", async () => {
+    const requestOrigins = [
+      "https://attacker-one.example",
+      "https://attacker-two.example",
+    ];
+    const observedOrigins: string[] = [];
+    mocks.getForwardedRequestOrigin
+      .mockReturnValueOnce(requestOrigins[0])
+      .mockReturnValueOnce(requestOrigins[1]);
+    mocks.createWorkspaceSsoEmbedSession.mockImplementation(async () => {
+      observedOrigins.push(getRequestContext()?.requestOrigin ?? "");
+      return { startUrl: START_URL, app: "analytics" };
+    });
+    const handler = createWorkspaceAppChatProxyHandler({
+      fetchImpl: stubFetch(() => new Response("ok", { status: 200 })),
+    });
+    const send = () =>
+      handler(proxyEvent("/_agent-native/workspace-app-chat/analytics"));
+
+    await send();
+    await send();
+
+    expect(observedOrigins).toEqual(["https://dispatch.agent-native.com"]);
+    expect(mocks.createWorkspaceSsoEmbedSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("uses a valid runtime origin when the configured production URL is invalid", async () => {
+    mocks.getAppProductionUrl.mockReturnValue("not-a-url");
+    mocks.getForwardedRequestOrigin.mockReturnValue("https://attacker.example");
+    const observedOrigins: string[] = [];
+    mocks.createWorkspaceSsoEmbedSession.mockImplementation(async () => {
+      observedOrigins.push(getRequestContext()?.requestOrigin ?? "");
+      return { startUrl: START_URL, app: "analytics" };
+    });
+    const handler = createWorkspaceAppChatProxyHandler({
+      fetchImpl: stubFetch(() => new Response("ok", { status: 200 })),
+    });
+
+    const response = await handler(
+      proxyEvent("/_agent-native/workspace-app-chat/analytics"),
+    );
+
+    expect(response.status).toBe(200);
+    expect(observedOrigins).toEqual(["https://workspace.agent-native.com"]);
+  });
+
+  it("returns a JSON error when no trusted origin is configured", async () => {
+    mocks.getAppProductionUrl.mockReturnValue("not-a-url");
+    mocks.resolveAppRuntimeUrl.mockReturnValue(undefined);
+    mocks.getForwardedRequestOrigin.mockReturnValue("https://attacker.example");
+    const handler = createWorkspaceAppChatProxyHandler({
+      fetchImpl: stubFetch(() => new Response("ok", { status: 200 })),
+    });
+
+    const response = await handler(
+      proxyEvent("/_agent-native/workspace-app-chat/analytics"),
+    );
+
+    expect(response.status).toBe(502);
+    await expect(response.json()).resolves.toMatchObject({
+      error: expect.stringContaining(
+        "Configured application origin is invalid.",
+      ),
+    });
+  });
+
   it("forwards agent-chat sub-paths and query strings unchanged", async () => {
     const fetchImpl = stubFetch(() => new Response("[]", { status: 200 }));
     const handler = createWorkspaceAppChatProxyHandler({ fetchImpl });

package/src/server/lib/workspace-app-chat-proxy.ts

@@ -1,5 +1,11 @@
 import { getOrgContext } from "@agent-native/core/org";
-import { getSession, runWithRequestContext } from "@agent-native/core/server";
+import {
+  getAppProductionUrl,
+  getForwardedRequestOrigin,
+  getSession,
+  resolveAppRuntimeUrl,
+  runWithRequestContext,
+} from "@agent-native/core/server";
 import {
   EMBED_START_PATH,
   EMBED_TOKEN_QUERY_PARAM,
@@ -7,8 +13,8 @@ import {
 
 import { parseWorkspaceAppChatProxyPath } from "../../shared/workspace-app-chat.js";
 import {
-  createGrantedDispatchMcpEmbedSession,
-  createWorkspaceSsoEmbedSession,
+  createGrantedDispatchMcpEmbedSessionForWorkspaceAppChat,
+  createWorkspaceSsoEmbedSessionForWorkspaceAppChat,
 } from "./mcp-gateway.js";
 
 const TARGET_CHAT_PATH = "/_agent-native/agent-chat";
@@ -62,12 +68,75 @@ export interface WorkspaceAppChatSession {
 
 const sessionCache = new Map<string, Promise<WorkspaceAppChatSession>>();
 
+interface WorkspaceAppChatProxyEvent {
+  url: URL;
+  req: Request;
+  context?: Record<string, unknown>;
+}
+
 function sessionCacheKey(input: {
   appId: string;
   userEmail: string;
   orgId: string | undefined;
+  requestOrigin: string;
 }): string {
-  return [input.userEmail, input.orgId ?? "", input.appId].join("\u0000");
+  return [
+    input.userEmail,
+    input.orgId ?? "",
+    input.requestOrigin,
+    input.appId,
+  ].join("\u0000");
+}
+
+type HttpOriginResult =
+  | { kind: "absent" }
+  | { kind: "invalid"; cause: unknown }
+  | { kind: "valid"; origin: string };
+
+function httpOrigin(value: string | undefined): HttpOriginResult {
+  if (value === undefined) return { kind: "absent" };
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      return {
+        kind: "invalid",
+        cause: new Error("Application origin must use HTTP or HTTPS."),
+      };
+    }
+    return { kind: "valid", origin: url.origin };
+  } catch (cause) {
+    return { kind: "invalid", cause };
+  }
+}
+
+function trustedWorkspaceRequestOrigin(
+  event: WorkspaceAppChatProxyEvent,
+): string {
+  const configured = httpOrigin(getAppProductionUrl());
+  const runtime = httpOrigin(resolveAppRuntimeUrl());
+  const request = httpOrigin(
+    getForwardedRequestOrigin(
+      event as unknown as Parameters<typeof getForwardedRequestOrigin>[0],
+    ),
+  );
+  const allowedOrigins = new Set(
+    [configured, runtime]
+      .filter(
+        (result): result is Extract<HttpOriginResult, { kind: "valid" }> =>
+          result.kind === "valid",
+      )
+      .map((result) => result.origin),
+  );
+
+  if (request.kind === "valid" && allowedOrigins.has(request.origin)) {
+    return request.origin;
+  }
+  if (configured.kind === "valid") return configured.origin;
+  if (runtime.kind === "valid") return runtime.origin;
+  if (configured.kind === "invalid" || runtime.kind === "invalid") {
+    throw new Error("Configured application origin is invalid.");
+  }
+  throw new Error("No trusted application origin is configured for app chat.");
 }
 
 function errorMessage(error: unknown): string {
@@ -99,13 +168,16 @@ export function embedSessionTokenExpiry(token: string): number {
   return exp * 1000;
 }
 
-async function mintEmbedStartUrl(appId: string): Promise<string> {
-  const input = { app: appId, path: "/", chrome: "minimal" } as const;
+async function mintEmbedStartUrl(
+  appId: string,
+): Promise<{ startUrl: string; appBaseUrl: string }> {
   try {
-    return (await createWorkspaceSsoEmbedSession(input)).startUrl;
+    return await createWorkspaceSsoEmbedSessionForWorkspaceAppChat(appId);
   } catch (ssoError) {
     try {
-      return (await createGrantedDispatchMcpEmbedSession(input)).startUrl;
+      return await createGrantedDispatchMcpEmbedSessionForWorkspaceAppChat(
+        appId,
+      );
     } catch (grantError) {
       throw new Error(
         `Could not create an app session for "${appId}". ` +
@@ -118,6 +190,7 @@ async function mintEmbedStartUrl(appId: string): Promise<string> {
 
 export async function exchangeEmbedStartUrl(
   startUrl: string,
+  expectedAppBaseUrl: string,
   fetchImpl: typeof fetch = fetch,
 ): Promise<WorkspaceAppChatSession> {
   const start = new URL(startUrl);
@@ -125,8 +198,6 @@ export async function exchangeEmbedStartUrl(
   if (startIndex < 0) {
     throw new Error("App session start URL is not an embed start route.");
   }
-  const appBaseUrl = `${start.origin}${start.pathname.slice(0, startIndex)}`;
-
   const response = await fetchImpl(start.toString(), { redirect: "manual" });
   await response.body?.cancel().catch(() => undefined);
   const location = response.headers.get("location");
@@ -137,22 +208,48 @@ export async function exchangeEmbedStartUrl(
   }
 
   const resolved = new URL(location, start);
+  if (resolved.origin !== start.origin) {
+    throw new Error("App session exchange redirected to an untrusted origin.");
+  }
+  const expectedApp = new URL(expectedAppBaseUrl);
+  if (
+    expectedApp.origin !== start.origin ||
+    !isWithinAppMount(expectedApp.pathname, resolved.pathname)
+  ) {
+    throw new Error("App session exchange redirected outside its app mount.");
+  }
   const token = resolved.searchParams.get(EMBED_TOKEN_QUERY_PARAM);
   if (!token) {
     throw new Error("App session exchange returned no embed token.");
   }
   return {
-    appBaseUrl,
+    appBaseUrl: `${expectedApp.origin}${expectedApp.pathname.replace(/\/+$/, "")}`,
     token,
     embedTarget: resolved.pathname,
     expiresAt: embedSessionTokenExpiry(token),
   };
 }
 
+function appPathSegments(pathname: string): string[] | null {
+  return pathname.split("/").filter(Boolean);
+}
+
+function isWithinAppMount(mountPath: string, targetPath: string): boolean {
+  const mount = appPathSegments(mountPath);
+  const target = appPathSegments(targetPath);
+  return (
+    mount !== null &&
+    target !== null &&
+    mount.length <= target.length &&
+    mount.every((segment, index) => target[index] === segment)
+  );
+}
+
 async function resolveWorkspaceAppChatSession(input: {
   appId: string;
   userEmail: string;
   orgId: string | undefined;
+  requestOrigin: string;
   fetchImpl: typeof fetch;
 }): Promise<WorkspaceAppChatSession> {
   const key = sessionCacheKey(input);
@@ -176,12 +273,16 @@ async function resolveWorkspaceAppChatSession(input: {
       {
         userEmail: input.userEmail,
         ...(input.orgId ? { orgId: input.orgId } : {}),
+        requestOrigin: input.requestOrigin,
       },
-      async () =>
-        exchangeEmbedStartUrl(
-          await mintEmbedStartUrl(input.appId),
+      async () => {
+        const embedSession = await mintEmbedStartUrl(input.appId);
+        return exchangeEmbedStartUrl(
+          embedSession.startUrl,
+          embedSession.appBaseUrl,
           input.fetchImpl,
-        ),
+        );
+      },
     ),
   );
   sessionCache.set(key, pending);
@@ -225,22 +326,15 @@ function proxyErrorResponse(status: number, message: string): Response {
   });
 }
 
-interface WorkspaceAppChatProxyEvent {
-  url: URL;
-  req: Request;
-}
-
 export function createWorkspaceAppChatProxyHandler(
   options: { fetchImpl?: typeof fetch } = {},
 ) {
   const fetchImpl = options.fetchImpl ?? fetch;
   return async (event: WorkspaceAppChatProxyEvent): Promise<Response> => {
     const url = event.url;
-    const mountedPathname = (
-      event as WorkspaceAppChatProxyEvent & {
-        context?: { _mountedPathname?: string };
-      }
-    ).context?._mountedPathname;
+    const rawMountedPathname = event.context?._mountedPathname;
+    const mountedPathname =
+      typeof rawMountedPathname === "string" ? rawMountedPathname : undefined;
     const parsed = parseWorkspaceAppChatProxyPath(
       mountedPathname ?? url.pathname,
     );
@@ -263,12 +357,15 @@ export function createWorkspaceAppChatProxyHandler(
       return proxyErrorResponse(401, "Sign in to Dispatch to use app chat.");
     }
 
+    let requestOrigin: string;
     let appSession: WorkspaceAppChatSession;
     try {
+      requestOrigin = trustedWorkspaceRequestOrigin(event);
       appSession = await resolveWorkspaceAppChatSession({
         appId: parsed.appId,
         userEmail: session.email,
         orgId,
+        requestOrigin,
         fetchImpl,
       });
     } catch (error) {
@@ -320,6 +417,7 @@ export function createWorkspaceAppChatProxyHandler(
           appId: parsed.appId,
           userEmail: session.email,
           orgId,
+          requestOrigin,
         }),
       );
     }

package/src/server/plugins/agent-chat.spec.ts

@@ -30,6 +30,7 @@ describe("Dispatch agent chat plugin", () => {
           "list-dispatch-usage-metrics",
         ]),
         mcp: {
+          appApprovalPage: true,
           connectorCatalog: expect.arrayContaining([
             "start-workspace-app-creation",
             "list-dispatch-usage-metrics",

package/src/server/plugins/agent-chat.ts

@@ -44,6 +44,7 @@ export default createAgentChatPlugin({
   durableBackgroundRuns: true,
   initialToolNames: INITIAL_TOOL_NAMES,
   mcp: {
+    appApprovalPage: true,
     connectorCatalog: [
       "resolve-integration-source-context",
       "start-workspace-app-creation",